Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18c8d82a authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

sfq: fix slot_dequeue_head() 



slot_dequeue_head() should make sure slot skb chain is correct in both
ways, or we can crash if all possible flows are in use.

Jarek pointed out slot_queue_init() can now be done in sfq_init() once,
instead each time a flow is setup.

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent eeaeb068

net/sched/sch_sfq.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -297,6 +297,7 @@ static inline struct sk_buff *slot_dequeue_head(struct sfq_slot *slot) 
	struct sk_buff *skb = slot->skblist_next;

	struct sk_buff *skb = slot->skblist_next;





	slot->skblist_next = skb->next;

	slot->skblist_next = skb->next;

	skb->next->prev = (struct sk_buff *)slot;

	skb->next = skb->prev = NULL;

	skb->next = skb->prev = NULL;

	return skb;

	return skb;

}

}
@@ -380,7 +381,6 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch) 
		q->ht[hash] = x;

		q->ht[hash] = x;

		slot = &q->slots[x];

		slot = &q->slots[x];

		slot->hash = hash;

		slot->hash = hash;

		slot_queue_init(slot);

	}

	}





	/* If selected queue has length q->limit, do simple tail drop,

	/* If selected queue has length q->limit, do simple tail drop,
@@ -545,8 +545,10 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt) 
			return err;

			return err;

	}

	}





	for (i = 0; i < SFQ_SLOTS; i++)

	for (i = 0; i < SFQ_SLOTS; i++) {

		slot_queue_init(&q->slots[i]);

		sfq_link(q, i);

		sfq_link(q, i);

	}

	return 0;

	return 0;

}

}